Back to KEVs

CVE-2011-0226

Integer signedness error in psaux/t1decode.c in FreeType before 2.4.6, as used in CoreGraphics in Apple iOS before 4.2.9 and 4.3.x before 4.3.4 and...

Basic Information

CVE State
PUBLISHED
Reserved Date
December 23, 2010
Published Date
July 19, 2011
Last Updated
August 06, 2024
Vendor
Apple
Product
iOS
Description
Integer signedness error in psaux/t1decode.c in FreeType before 2.4.6, as used in CoreGraphics in Apple iOS before 4.2.9 and 4.3.x before 4.3.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Type 1 font in a PDF document, as exploited in the wild in July 2011.
Tags
ios

CVSS Scores

CVSS v2.0

9.3

Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploit Status

Exploited in the Wild
Yes (2011-07-19 22:00:00 UTC) Source

References

http://secunia.com/advisories/45224 http://support.apple.com/kb/HT4803 http://lists.apple.com/archives/security-announce/2011//Jul/msg00000.html http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00015.html http://www.securityfocus.com/bid/48619 http://lists.nongnu.org/archive/html/freetype-devel/2011-07/msg00020.html http://lists.apple.com/archives/security-announce/2011//Jul/msg00001.html http://secunia.com/advisories/45167 http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html http://www.redhat.com/support/errata/RHSA-2011-1085.html http://support.apple.com/kb/HT4802 http://lists.nongnu.org/archive/html/freetype-devel/2011-07/msg00015.html http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00016.html http://lists.nongnu.org/archive/html/freetype-devel/2011-07/msg00028.html http://www.debian.org/security/2011/dsa-2294 http://support.apple.com/kb/HT5002 http://www.mandriva.com/security/advisories?name=MDVSA-2011:120 http://www.appleinsider.com/articles/11/07/06/hackers_release_new_browser_based_ios_jailbreak_based_on_pdf_exploit.html http://lists.nongnu.org/archive/html/freetype-devel/2011-07/msg00014.html http://lists.nongnu.org/archive/html/freetype-devel/2011-07/msg00026.html

Known Exploited Vulnerability Information

Source Added Date
CVE 2011-07-19 22:00:00 UTC

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Added to KEVIntel